The focus in this is around Integration & what Intel is doing to make it easier.   - ENJOY- Part III coming up next...

Hello vPro Experts!

I would like to take some time to touch on exploration of the management engine via the local interface (specifically the HECI driver). In order to follow the exercise here, you'll need to have Windows Powershell installed, have the Intel AMT Developer Toolkit downloaded and installed, and have an AMT client (does not need to be provisioned) with the HECI driver installed. The HECI driver should be downloadable from your OEM.

To give you a high-level idea of the program flow we'll use to access the AMT device, consider the following:

1. Load the "Manageability Stack.dll" .NET library
2. Create an instance of the ManageabilityStack.HeciWrapper object
3. Reference the properties and methods of the HeciWrapper object, and the HeciMeInfo object (provided by the HeciWrapper.MeInfo property)

Here is the Powershell code that correlates to the above process:

Loading the .NET Library

# Load the Manageability Stack .NET library

$AmtLib = "C:\Program Files\Intel\Manageability Developer Tool Kit\Manageability Stack.dll"
[System.Reflection.Assembly]::LoadFile($AmtLib)
# Create a HeciWrapper object

$Heci = New-Object ManageabilityStack.HeciWrapper

# Pipe the $Heci variable into the Get-Member cmdlet to determine what properties

# and methods are available to us.

$Heci | Get-Member

Obtaining a list of embedded certificate hashes

# List embedded certificate hashes
$Heci.MeInfo.EnumerateHashHandles()

Getting the BIOS and AMT Versions

# Retrieve the AMT version
Write-Host "AMT version: $($Heci.Versions.Versions["AMT"])"
# Retrieve the BIOS version
Write-Host "BIOS version: $($Heci.Versions.BiosVersion)"

Retrieving Provisioning Information

# Retrieve the provisioning server name
Write-Host "Provisioning server: $($Heci.MeInfo.GetAuditRecord().ProvServerFQDN)"
# Determine provisioning date
# This will return "01/01/0001 00:00:00" if not provisioned
Write-Host "Provision date: $($Heci.MeInfo.GetAuditRecord().TlsStartTime)"
# Get provisioning mode (Enterprise, SMB, etc.)
Write-Host "Provision mode: $($Heci.MeInfo.GetProvisioningMode().ProvisioningMode)"
# Get provisioning state
Write-Host "Provision state: $($Heci.MeInfo.GetProvisioningState())"

-----------------------------------

I hope these code samples are able to help you out in your administration / engineering endeavors! Please let me know if you have any questions, and don't forget that in Powershell .... when in doubt .... use Get-Member to discover what information is available to you!

Trevor Sullivan

Systems Engineer

OfficeMax Corporation

Finally, here's the "silent" video of Remote Access (Fast Call for Help) (code name:  CIRA).. .  Frank & I will be doing another one that is more interactive, with audio, etc..  However for now just wanted to show the community that it's working..

Just uploaded the updated user guide, which supports Intel AMT 5.0 on the McCreary platform. It's loaded with screenshots and discusses configuration procedures for Basic (SMB), Standard, and Advanced (Enterprise) provisioning models.

Intel(R) Management Engine User Guide (Intel AMT 5.0)

In the last part of the latest edition of the Intel Technology Journal (ITJ), I write about a new usage for Intel AMT and peer-to-peer computing. See Extreme Programming with Intel® vPro™ Technology: Pushing the Limits with Innovative Software.

The general idea is that you can use Intel AMT to represent a computer while it’s asleep to the rest of the peers. Normally, when you have lots of computers talking to each other in a peer-to-peer network and one of them goes to sleep, it just disappears from the network, just as if it had been completely disconnected.

Intel AMT can allow for network presence of a sleeping computer in a peer-to-peer network by creating an Intel AMT guest account that is very limited in its access (General Info + 3PDS) but allows other computers in the network to occasionally connect and read it’s sleeping state. This has many benefits: In the past, peer-to-peer networks required all computers to be always on; this is no longer the case. By using 3PDS, even off, computers are still discoverable and searchable.

Imagine for a moment 100 sleeping computers in a room. Someone wakes one up and searches for a tutorial video file located on one of the other sleeping computers. With Intel AMT and a peer-to-peer network, software can search all of the computers, find the one with the file, wake it up and download the file. Everything is very power efficient.

This technique does not have to be used only for files; you can find hardware, free disk space, backups, software and hardware services, etc.

Ylian

Hello!

Have you ever run into the situation where you want to enable the auto-provisioning policy for a ConfigMgr client, but dont' want to wait for the policy to filter down to the client? If you're like me, then you would answer with a hearty "yes." Thankfully, I've got a method for you to force an SCCM client to enable auto-provisioning, without relying on the collection setting!

Keep in mind that, for some odd reason, pasting this code into a Powershell window will probably fail. Instead, paste the first 4 lines, and manually type out the last (red) line.

$OobSettings =  [wmiclass]”root\ccm\policy\machine\actualconfig:CCM_OutOfBandManagementSettings”
$OobSettingsInstance =  $OobSettings.CreateInstance()
$OobSettingsInstance.AutoProvision =  $True
$OobSettingsInstance.SiteSettingsKey =  1
$OobSettingsInstance.Put()

Basically what this does is spawn an instance of the CCM_OutOfBandManagementSettings WMI class, sets two properties on it, and then writes it back to the system. This should enable auto-provisioning immediately so you don't have to wait!

Trevor Sullivan

Systems Engineer

OfficeMax Corporation

Various news outlets are reporting what is now unfortunately a familiar story - Another batch of 'missing' computers.  In this case, it's the Los Alamos nuclear weapons laboratory in New Mexico that is reporting 67 missing computers, including 13 that were lost or stolen in the past year:

http://www.eweek.com/c/a/Security/Los-Alamos-Lab-Missing-Almost-100-Computers/

Although Los Alamos officials claim no classified information has been compromised, there are security issues as the computers apparently contained personal information such as names and addresses.

Of the stolen machines, two that were taken from an employee's home weren't authorized for 'home use.'

This demonstrates many key points, one of which is this: It doesn't matter if you have good written policies.  If you can't effectively track machines that might be in contravention of security policies and then do something about it, then the policies aren't worth any more than the paper on which they're written.

Could a solution like Computrace & Intel AT-p have helped in this scenario?  Of course it could have.  Imagine if those machines were equipped with CT & AT-p.  Computrace could alert an IT Administrator if a machine was calling home from somewhere it shouldn't be - like an employees home - and AT-p could be used to administer a 'poison pill' to any machine that calls in from somewhere it doesn't belong.

Instead of the another round of negative publicity the they could have simply have announced that while there had been a breach of policy, it had been contained.

So what are Platform Event Traps and what is its relevance to managed systems? With Intel AMT Remote Management you always recieve readily available access to event logs of these things: PC Sensors, effectors, and other non-volatile data. But, what you might not know is that it can also generate out-of-band alerts (PETs) based on sensor events. Platform Event Trap is a specification defining the format for managed systems to alert a remote console. Intel AMT uses this PET format to send these event alerts. And while ASF does the same, with Intel AMT PETs you can subscribe up to 16 different destinations. With ASF, you have to decide on just one unique destination point for every event/alert.

Interested and want to learn more? Below you can find some blogs that can provide some further insight.

More Technology Distinctions - Intel AMT vs ASF: This is part three from Shmuel Gershon in comparing ASF and Intel AMT features on the Intel Software Network.

Between Intel AMT and ASF: Here you can find part 4 of Shmuel Gershon's comparisons.

What about those PET events?: Gael Holmes covers all you need to know on PETs and links to many other questions, blogs, and documents that will lead you to more information on these Platform Event Traps.

"Happy PETting!"

Hi everyone. I have not been posting much lately, but have been keeping busy writing a book and white papers on Intel AMT. In the last section of the Intel Technology Journal article on extreme usages, I talk about how Intel AMT could be used to build a peer-to-peer mesh network, and that is what I have been working on for the last few months. More to come on this I am sure.

Right now, I want to talk about Wake-on-LAN and Intel AMT. I read somewhere that wake-on-LAN is obsolete with Intel AMT, but I want to disagree and explain why Intel AMT in fact makes Wake-on-LAN better. For people how don’t know, Wake-on-LAN is a way to wake-up a computer using a magic packet composed anywhere in the payload of “FFFF FFFF FFFF” + 16 repetitions of the MAC address of the computer you want to wake up.

In normal circumstances, the magic packet can only be really used within the same Ethernet subnet as the computer you want to wakeup. All this changes if the target computer supports Intel AMT, since even when sleeping or in soft-off, the Intel AMT computer will defend its IP address (ARP Protocol), it’s now possible to send a directed magic packet to a computer across many routers and have it reach its destination correctly and so, wake up the PC.

Now, why would you use a magic packet if you can use Intel AMT to do the same? Everything has to do with security. Because of how Intel AMT security realms are designed, granting permission within Intel AMT for a users to wake up a computer, also grants the same user permission to shutdown the PC at anytime (and not a nice shutdown too). You can’t just grant only the “power on” access in Intel AMT and so, this is a security concern.

In conclusion, if we want other general users to be able to wake up a PC on the network to perform routine tasks (access files, backup data, etc .). Making use of Wake-on-LAN + Intel AMT makes a lot of sense. With Intel AMT PC’s, Wake-on-LAN now works better than ever.

Ylian